{"action":"Upgrade js-toml to 1.1.2 or later.","affected":[{"fixed":"1.1.2","introduced":"0"}],"component":"js-toml","cve_ids":["CVE-2026-50029"],"ecosystem":"npm","epss":0.00398,"exploited":false,"fixed_versions":["1.1.2"],"ghsa_id":"GHSA-m34p-749j-x6m6","id":"tcs_01M5KFZDWZCS9FCM1T45KCGSZE","modified_at":"2026-07-21T17:30:26.096074019Z","published_at":"2026-06-26T22:49:28Z","references":["https://osv.dev/vulnerability/GHSA-m34p-749j-x6m6","https://github.com/sunnyadn/js-toml/security/advisories/GHSA-m34p-749j-x6m6","https://github.com/sunnyadn/js-toml/commit/e0504fa5d3dcde2d1d588c9001c24b7b700beeeb","https://github.com/sunnyadn/js-toml","https://github.com/sunnyadn/js-toml/releases/tag/v1.1.2"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-m34p-749j-x6m6","url":"https://osv.dev/vulnerability/GHSA-m34p-749j-x6m6"}],"summary":"js-toml has silent type confusion via falsy-primitive duplicate-key bypass"}